Remove hacky postinstall script

Before, we had to manually call `npm install` for client-side NPM
dependencies so that Stitch could find them. Now that we're using
Browserify, that is no longer necessary.
don't pass through headers from the incoming req

when implementing #228 I accidentally passed through all the headers by using
_.extend.

fixes #237: this bug was caused by passing through the `host` header, which
will lead to the api proxy trying to make an https request against the http
render app instead of the actually configured api host which expects the https
connection
Merge pull request #241 from c089/fix-leaking-headers

don't pass through headers from the incoming req
Merge pull request #243 from airbnb/remove-postinstall

Remove hacky postinstall script